It's not much of a sandbox if permissions exist to escape the sandbox. All "secure" apps (mail, pay, banking, chat, ...) need to live in a special compartment which they cannot escape, and no installed apps are allowed in this compartment, only builtin apps.

Everything else lives in a more relaxed compartment which cannot access the "secure" compartment at all.

Essentially two devices, one completely locked up, the other completely open.